CyberRota Analysis
AI-GeneratedThe vulnerability affects n8n versions prior to 1.123.67, 2.31.5, and 2.32.1, specifically in the PostgresTrigger node, where user-supplied parameters are improperly handled in SQL statements. This SQL injection flaw allows authenticated users to execute arbitrary SQL commands against the connected PostgreSQL database, potentially leading to unauthorized data access and manipulation. Organizations using affected versions should prioritize patching to mitigate the risk of data breaches and unauthorized database modifications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access.